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This listing of claims will replace all prior versions and listings of claims in the 

application: 

1 . (Previously Presented) A data processing apparatus for correlating network 
events among a number of client services comprising: 
at least one computer comprising: 

a memory having program instructions; and 
a processor configured to use said program instructions to provide: 
a network management service; 
an event notification service; 
a network mediation service adapted to: 

receive a raw event from an external computer network; and 
transmit said raw event to said event notification service; 

a message parsing service adapted to: 

receive a raw event from said event notification service; 
parse said raw event; and 

transmit said parsed event to said event notification service; 
and 

an event correlation service coupled to a knowledge database comprising 
correlation knowledge, said event correlation service adapted to: 

receive said parsed event from said event notification 

service; 
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utilize data stored in said knowledge database to 

derive an event from said parsed event; and 

transmit said derived event to one of a plurality of 

operator workstations via said event notification 
service, regardless of a significance of said derived 

event; 

wherein said network mediation, message parsing, 
event notification and network management services 

are coupled together via a plurality of interfaces. 

2. (Original) The data processing apparatus of claim 1, wherein said network 
mediation service is adapted to interface with at least one external computer network. 

3. (Original) The data processing apparatus of claim 2, wherein said network 

mediation service is further adapted to: 

receive a raw event at said network mediation service from said external computer 

network; and 

transmit said raw event to said message parsing service. 

4. (Original) The data processing apparatus of claim 1, wherein said message 
produce a parsed event. 
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5. (Original) The data processing apparatus of claim 4, wherein said message 
parsing service is adapted to route said parsed event to said network management service via said 
event notification service. 

6. (Original) Thedataprc^essmgapparatusofclaim5,whereinsaidmessage 
parsing service is adapted to route said parsed event to said event correlation service via said 
event notification service. 

7. (Original) The data processing apparatus of claim 1, wherein said network 
management service is adapted to interface with a plurality of operator workstations. 

8. (Original) The data processing apparatus of claim 1, wherein said network 
management service is further adapted to: 

receive data requests from said plurality of operator workstations; and 

transmit said data requests to said event correlation service via said event notification 

service. 

9. (Original) The data processing apparatus of claim 4, wherein said event 
notification service is further comprised of: 

a raw event channel; 

a parsed event channel; and 

a derived event channel. 
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10. (Original) The data processing apparatus of claim 9, wherein said event 
notification service is further comprised of at least one filter. 

11. (Original) The data processing apparatus of claim 10, wherein said at least 
one filter is coupled to at least one of said plurality of event channels. 



12. (Original) The data processing apparatus of claim 9, wherein said raw event 

channel is adapted to: 

receive a raw event from said network mediation service; and 
transmit said raw event to said message parsing service. 

13. (Currently Amended) The data processing apparatus of claim 9, wherein said 

parsed event channel is adapted to: 

receive a raw event v «r«A message from said message parsing service; and 
transmit said jaw-event p^ed message to said network management service. 

14. (Original) The data processing apparatus of claim 9, wherein said parsed 

event channel is adapted to: 

receive a parsed event from said message parsing service; and 
transmit said parsed event to said event correlation service. 

15. (Original) The data processing apparatus of claim 9, wherein said derived 
event channel is adapted to: 
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receive a derived event from said event correlation service; and 
transmit said derived event to network management service. 

1 6 . (Previously Presented) A method for correlating network event messages 
onacomputer network comprising a message parsing service, an event correlation service, and a 
knowledge database coupled togemer via a pluraUty of interface 
steps of: 

receiving a raw event at said message parsing service; 

parsing said raw event by said message parsing service; 

transmitting said parsed event to said event correlation service; 

utilizing data stored in said knowledge database to derive an event from said parsed 

event; and 

transmitting said derived event to one of a plurality of operator workstations, regardless 
of a significance of said derived event. 

17. (Original) The method of claim 16, wherein said step of transmitting said 
derived event to one of a plurality of operator workstations, further comprising the following 

steps: 

transmitting said derived event from said event correlation service to a network 

management service; and 

transmitting said derived event from said network management service to one of a 

plurality of operator workstations. 
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18. (Previously Presented) A method for correlating network event messages 
on a computer network comprising a network mediation service, a message parsing service, an 
event notification service, an event correlation service, and a knowledge database coupled 
together via a plurality of interfaces, said method comprising the steps of: 

receiving a raw event at said network mediation service from an external computer 

network; 

transmitting said raw event to said message parsing service; 
parsing said raw event by said message parsing service; 
transmitting said parsed event to said event correlation service; 
utilizing data stored in said knowledge database to derive an event from said parsed 
event; and 

transmitting said derived event to one of a plurality of operator workstations, regardless 
of a significance of said derived event. 

19. (Original) The method of claim 18, wherein said step of transmitting said raw 
event to said message parsing service, further comprises the steps of: 

transmitting said raw event from said network mediation service to said event notification 

service; and 

transmitting said raw event from said event notification service to said message parsing 
service. 
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20. (Original) The method of claim 19, wherein the step of transmitting said raw 
event from said event notification service to said message parsing service, further comprises the 

following steps: 

receiving said raw event at a raw event channel; 
processing said raw event by said raw event channel; and 

transmitting said raw event from said raw event channel to said message parsing service. 

21. (Original) The method of claim 20, wherein said step of transmitting said raw 
event from said raw event channel to said message parsing service, further comprises the 
following steps of: 

transmitting said raw event from said raw event channel to at least one event filter; and 
transmitting said raw event from said at least one event filter to said message parsing 
service. 

22. (Original) The method of claim 18, wherein said step of transmitting said 
parsed event to said event correlation service, further comprises the steps of: 

transmitting said parsed event from said message parsing service to said event 

notification service; and 

transmitting said parsed event from said event notification service to said event 

correlation service. 
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23 (Original) The method of claim 22, wherein the step of transmitting said 
parsed event from said event notification service to said event correlation service, further 
comprises the following steps: 

receiving said parsed event at a parsed event channel; 

processing said parsed event by said parsed event channel; and 

transmitting said processed event from said parsed event channel to said event correlation 
service. 

24. (Original) The method of claim 23, wherein said step of transmitting said 
processed event from said parsed event channel to said event correlation service, further 
comprises the following steps: 

transmitting said processed event from said parsed event channel to at least one event 

filter; and 

transmitting said processed event from said at least one event filter to said event 
correlation service. 

25. (Original) The method of claim 18, wherein said step of transmitting said 
derived event to one of a plurality of operator workstations, further comprises the steps of: 

transmitting said derived event from said event correlation service to said event 

notification service; and 

transmitting said derived event from said event notification service to said network 

management service; and 
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transmitting said derived event from said network management service to one of a 
plurality of operator workstations. 

26. (Original) The method of claim 25, wherein the step of transmitting said 
derived event from said network management service to one of a plurality of operator 
workstations, further comprises the following steps: 

receiving said derived event at a derived event channel; 
processing said derived event by said derived event channel; and 
transmitting said processed event from said derived event channel to said network 
management service. 

27. (Original) The method of claim 26, wherein the step of transmitting said 
processed event from said derived event channel to said network management service, further 
comprises the following steps: 

transmitting said processed event from said derived event channel to at least one event 

filter; and 

transmitting said processed event from said at least one event filter to said network 
management service. 

28. (Currently Amended) A method for correlating network event messages on a 
computer network comprising a network mediation service, a message parsing service, an event 
notification service, and a network management service coupled together via a plurality of 
interfaces, said method comprising the steps of: 
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receiving a raw event at said network mediation service from an external computer 
network; 

transmitting said raw event to said message parsing service; 
parsing said raw event by said message parsing service; and 
transmitting said parsed event to said network management service, regardless of a 
significance of said parsed event. 

29. (Original) The method of claim 28, wherein said step of transmitting said 
parsed event to said network management service, further comprises the steps of: 

transmitting said parsed event from said message parsing service to said event 

notification service; and 

transmitting said parsed event from said event notification service to said network 

management service. 

30. (Original) The method of claim 29, wherein the step of transiting said 
parsed event from said even, notification service to said network management service, further 
comprises the following steps: 

receiving said parsed event at a parsed event channel; 

processing said parsed event by said parsed event channel; and 

transmitting said processed event from said parsed event channel to said network 

management service. 
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31. (Original) The method of claim 30, wherein said step of transmitting said 
processed event from said parsed event channel to said network management service, further 
comprises the following steps of: 

transmitting said processed event from said parsed event channel to at least one event 

filter; and 

transmitting said processed event from said at least one event filter to said network 
management service. 

32. (Previously Presented) A data processing apparatus for correlating network 
events among a number of client services comprising: 

means for receiving a raw event at a message parsing service; 

means for parsing said raw event by said message parsing service; 

means for transmitting said parsed event to an event correlation service; 

means for utilizing data stored in a knowledge database to derive an event from said 

parsed event; and 

means for transmitting said derived event to one of a plurality of operator workstations, 
regardless of a significance of said derived event. 

33. (Previously Presented) A computer system for correlating network events 
among a number of client services comprising: 

a memory having program instructions; and 

a processor configured to use the program instructions to receive a raw event at a network 
mediation service from an external computer network; to transmit said raw event to a message 
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parsing service; to parse said raw event by said message parsing service; to transmit said parsed 

event to a event correlation service; to utilize data stored in a knowledge database to derive an 

event from said parsed event; and to transmit said derived event to one of a plurality of operator 

workstations, regardless of a significance of said derived event 
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